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Measurement-device-independent quantum key distribution (MDI-QKD), which is immune to all 
detector side-channel attacks, is the most promising solution to the security issues in practical 
quantum key distribution systems. Though several experimental demonstrations of MDI-QKD have 
been reported, they all make one crucial but not yet verified assumption, that is there are no flaws 
in state preparation. Such an assumption is unrealistic and security loopholes remain in the source. 

Here we present, to our knowledge, the first MDI-QKD experiment with the modulation error taken 
into consideration. By applying a security proof by Tamaki et al (Phys. Rev. A 90, 052314 (2014)), 
we distribute secure keys over fiber links up to 40 km with imperfect sources, which would not have 
been possible under previous security proofs. By simultaneously closing loopholes the detectors and 
a critical loophole - modulation error in the source, our work shows the feasibility of secure QKD 
with practical imperfect devices. 

PACS numbers: 03.67.Dd, 03.67.Hk, 42.50.Ex 


Quantum key distribution (QKD), in principle, offers 
unconditional security based on the laws of quantum 
physics rather than computational complexity [1]. How¬ 
ever, it has been realized that, due to the gap between 
the security proof and real-life implementations, practical 
QKD systems are vulnerable to various attacks [2]. 

Device-independent QKD (DI-QKD) [3], was proposed 
to remove all assumptions of the internal working of 
devices of QKD. The security of DI-QKD is based on 
the loophole-free Bell test. Despite a number of re¬ 
cent experimental demonstrations of loophole-free Bell 
test [4], DI-QKD is impractical at practical distances 
(20-30 km of telecom fiber) due to its low key rate of 
about 10 -10 bit per pulse [5]. Fortunately a proto¬ 
col, namely the Measurement-Device-Independent QKD 
(MDI-QKD), whose security is built on the time-reversed 
entanglement QKD [6] , has been proposed [7] to remove 
all potential security loopholes in the detection side, the 
most vulnerable part of a QKD system (See also [8]). Sev¬ 
eral MDI-QKD demonstrations using polarization [9, 10] 
and time-bin phase [11] encoding have been reported. 
More recently, MDI-QKD over 200 km [12], a field test 
[13], a network demonstration [14], and an implemen¬ 
tation with 1 GHz clock rate [15] have been reported, 
highlighting the practicality of this protocol. MDI-QKD 
with continuous variables has also been proposed in [16]. 

It is conceivable that MDI-QKD [7] will be widely 
adopted in the near future. Since MDI-QKD is intrinsi¬ 
cally immune to all detector side-channel attacks, eaves¬ 
droppers will shift their focus from hacking the detectors 
to hacking the sources, which are not protected in MDI- 
QKD. Several theoretical studies on MDI-QKD with im¬ 
perfect sources have been reported [17]. 


A crucial assumption in discrete-variable MDI-QKD 
is that the source employed must be trusted. An ideal 
trusted source need to satisfy two conditions: first, 
the source only emits single photons; second, informa¬ 
tion should be encoded without flaws. However, these 
two conditions cannot be satisfied perfectly with to¬ 
day’s technology. First, phase-randomized weak coher¬ 
ent pulses (WCPs) rather than single-photon sources are 
widely used in most QKD (including BB84 and MDI- 
QKD) demonstrations. Fortunately, it has been shown 
that unconditional security can still be achieved with 
phase-randomized WCPs [18]. Furthermore, the perfor¬ 
mance can be significantly improved with the decoy state 
method [19]. Second, encoding quantum states onto op¬ 
tical pulses has inherent errors due to the finite inac¬ 
curacies in practical encoding devices. However, such 
errors are ignored in all previous discrete-variable MDI- 
QKD demonstrations [9-13]. It is unrealistic to ignore all 
those errors because they may lead to security loopholes 
that a eavesdropper might conceivably exploit to launch 
attacks. 

Such state preparation flaws can be taken care of using 
the quantum coin idea [18, 20]. However, this approach 
assumes the worst case in which an eavesdropper can 
enhance the flaws by channel loss, and therefore the per¬ 
formance is not loss tolerant. The study in [20] shows 
that highly accurate state preparations are required in 
MDI-QKD. 

Recently, Tamaki et al have proposed a loss-tolerant 
security proof [21] that can take modulation error - a 
most crucial flaw in a QKD source, into consideration. 
The loss-tolerant protocol is secure against the most gen¬ 
eral type of attacks. For ease of discussion, the intuition 
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behind the security of the loss-tolerant protocol can be 
understood for the example of the unambiguous state dis¬ 
crimination (USD) attack. The idea is that, as long as 
the states are encoded in 2-dimensional qubits [22], it is 
impossible for Eve to launch a USD attack. Therefore 
Eve cannot enhance state preparation flaws of qubits by 
channel loss. The performance of QKD can thus be dra¬ 
matically improved even when the state preparation flaws 
are considered. This idea has been applied to both the 
BB84 protocol and the three-state prepare-and-measure 
protocol [23], and an experimental demonstration is re¬ 
ported in [24]. 

It is noteworthy that this security proof can be applied 
to MDI-QKD. In this Letter, we extend the work in [21] 
and present an experimental demonstration of MDI-QKD 
with state preparation imperfections over fiber links of 
10 km and 40 km. By closing an important potential 
loophole in MDI-QKD, we achieved improved security 
compared to previous demonstrations. 

The contributions of this Letter are as follows. First 
and most importantly, in contrast to previous MDI-QKD 
demonstrations [9-13] which unrealistically assume per¬ 
fect state preparations, we carefully optimize the state 
preparation to minimize the preparation flaws and per¬ 
form a complete characterization of the states using 
quantum state tomography. For the first time, we in¬ 
clude the state preparation flaws into secure key rate es¬ 
timation. We highlight that this would not have been 
possible under previous security proofs [18, 20]. Second, 
we remark that the analysis in [21] only applies to the 
asymptotic case with an infinite number of decoy states 
and an infinitely long key. We here present the theory 
(see Supplemental Material) which shows how the loss- 
tolerant protocol can be applied to MDI-QKD in a real¬ 
istic setting, where only a finite number of decoy states 
and a key of finite length are available. Third, we improve 
the key generation speed by increasing the system rep¬ 
etition rate from 500 kHz [9] to 10 MHz and employing 
free-running single-photon detectors with 20% quantum 
efficiency. These technological improvements enable us to 
get a positive key rate within a reasonable time frame, 
even when finite key effects and encoding flaws are taken 
into account, and thus demonstrate the practicality of 
the protocol. 

We first briefly explain the loss-tolerant MDI-QKD 
protocol. Alice (Bob) randomly encodes her (his) key 
bits into one of the three polarization states { po z , pi z , 
po x }i where pi a is the density matrix of the polarization 
state of single photons corresponding to the bit value 
i E {0,1} in the basis a G {Z, X}. She (He) then sends 
her (his) encoded WCPs to an untrusted third party, Eve, 
who can be an eavesdropper, to do Bell state measure¬ 
ments (BSMs). After a sufficient number of key bits have 
been transmitted, Eve announces the BSM results to Al¬ 
ice and Bob. Alice and Bob also announce their basis 
choices over a public authenticated channel and generate 


a sifted key. By revealing part of the sifted key, they can 
estimate the bit error rate in the Z basis and perform 
error corrections. 

We apply the decoy state method [25] to estimate the 
gain of single photons in the Z basis. The phase error 
rate of single photons e^, which quantifies the informa¬ 
tion leakage to an eavesdropper, is estimated from the 
transmission rates of fictitious states using the rejected 
data analysis [21]. Privacy amplification can then be per¬ 
formed to generate a secret key. 



FIG. 1. (Color online). Schematic of the experiment. Alice 
(Bob) possesses a frequency-locked CW laser at 1542 nm. The 
light is attenuated by an variable optical attenuator (VOA). 
The phase is randomly modulated by a phase modulator (PM) 
and the intensity is modulated by an intensity modulator (IM) 
to generate phase-randomized WCPs. An acousto-optic mod¬ 
ulator (AOM) is used to randomly switch the intensity be¬ 
tween signal and decoy states. Key bits are encoded by a 
polarization modulators (Pol-Ml). Pol-M2 in Alice is used 
for polarization alignment. Eve’s Bell state measurement 
setup consists of a beam splitter (BS), three fiber polariza¬ 
tion controllers (FPCs), a polarizing beam splitter (PBS), 
two single-photon detectors (SPDs), and a time interval ana¬ 
lyzer (TIA). Acronyms for other components: RNG: random 
number generators; PG: pulse generators; EDL: electrical de¬ 
lay line; SQU: square wave generator; OVDL: optical variable 
delay line. 

Fig.l shows the schematic of our experiment. Alice 
and Bob each have a CW laser whose wavelength is in¬ 
dependently locked to the P16 line of a C13 acetylene 
gas cell (integrated in Alice’s and Bob’s lasers by the 
manufacturer) at 1542.38 nm. The frequency locking en¬ 
sures that the frequency difference between Alice’s and 
Bob’s lasers is within 10 MHz, guaranteeing the spec¬ 
tral indistinguishability. The laser light is attenuated 
by a variable optical attenuator (VOA) down to single¬ 
photon level at the output of Alice’s / Bob’s system. 
Its phase is randomized by a phase modulator into 1000 
discrete random phases distributed uniformly in [0, 27t], 
which gives performance close to the case of continuous 
phase randomization [26]. The amplitude of the light is 
modulated by an intensity modulator (IM) to generate 
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phase-randomized weak coherent pulses at a repetition 
rate of / = 10 MHz, with a full width at half maximum 
(FWHM) of around 2.5 ns. 

Each pulse’s intensity is randomly modulated by an 
acousto-optic modulator (AOM). We implement the 2- 
decoy protocol, i.e., each pulse’s amplitude is modulated 
to either the signal state or one of the two decoy states. 

Key bits are encoded into the polarization states of the 
optical pulses by a polarization modulator (Pol-M). The 
Pol-M consists of a phase modulator, an optical circu¬ 
lator, and a Faraday mirror. Polarization modulation is 
achieved by bi-directional modulation of the phase differ¬ 
ence of the TE and TM components of the waveguide in 
the phase modulator. Details of the Pol-M setup can be 
found in [9, 27]. In the three state protocol, each pulse’s 
polarization is randomly modulated to one of the three 
BB84 states: the horizontal state p^ z , the vertical state 
pi z , and the diagonal state po x . We fine tuned the volt¬ 
ages on the Pol-Ms to minimize the preparation flaws of 
these states. See the Supplemental Material for details. 

Alice’s and Bob’s pulses are sent through 2 sepa¬ 
rate fiber spools to Eve for Bell state measurements 
(BSMs). BSMs require indistinguishability between Al¬ 
ice and Bob’s pulses in all degrees of freedom (except 
polarization, which is used for encoding). The spectral 
indistinguishability can be guaranteed by frequency lock¬ 
ing in the laser as discussed above (the frequency differ¬ 
ence of 10 MHz is much less than the bandwidth of a 
transform-limited pulse of 2.5 ns). To achieve the tempo¬ 
ral indistinguishability, arrival times of Alice’s and Bob’s 
pulses are controlled by two passive electrical delay lines 
(EDLs) and two optical variable delay lines (OVDLs). 
The EDLs, which can adjust the delay of the the clock 
signal driving the intensity modulators (and thus the ar¬ 
rival time of the pulses), have a resolution of 0.5 ns and a 
range of 63.5 ns, and are used for coarse temporal align¬ 
ments. The relative delay is further finely adjusted by 
the OVDLs with a resolution less than 10 ps, which is 
much smaller than the pulses’ width of 2.5 ns FWHM. 

Alice and Bob need to establish a common polariza¬ 
tion reference frame. To achieve this, they first align 
their Z basis (pq z an d Pi z ) t° the polarizing axes of the 
PBS in Eve’s BSM setup. Alice has an extra polarization 
modulator (Pol-M2 in Fig.l) in her lab. This modulator 
modulates the relative phase between | H) (po z ) and \V) 
(pi z ). This is equivalent to a unitary rotation about the 
H — V axis on the Poincare sphere, and the amount of 
rotation depends on the voltage applied on Pol-M2. Al¬ 
ice adjusts the voltage such that her diagonal state po x 
is aligned to that of Bob. 

Alice and Bob’s pulses interfere at the 50/50 beam 
splitter and are sent to a polarizing beam splitter (PBS), 
whose outputs are connected to two free running In- 
GaAs/InP single-photon detectors (SPDs, ID220) with 
20% quantum efficiency and a dark count rate of 2 kHz. 
Times of the detection events (relative to the clock signal) 


are recorded by a time interval analyzer (TIA). Within 
each period (100 ns), a 7 ns window is chosen (by cali¬ 
brating the arrival times of optical pulses) to post-select 
detection events. Therefore, over 90% of the dark count 
noise can be removed and the effective dark count proba¬ 
bility per window is around 1.5 x 10 -5 . A coincidence be¬ 
tween these two detectors implies a successful projection 
onto the triplet Bell state |T + ) = (| HV) ± \ VH))/y/2. 

We characterize the polarization states po z , pi z: po x } 
prepared by the Pol-Ms using quantum state tomogra¬ 
phy. We perform projective measurements by sending 
the polarization-encoded photons to a polarization an¬ 
alyzer (HP8169A), which consists of a half-wave plate 
(HWP), a quarter-wave plate (QWP), and a polarizer 
(POL). Angles of the waveplates and the polarizer are 
driven by electrical motors with an accuracy of ±0.1° 
(specified by the manufacturer). A SPD is connected 
to the output of the polarizer for detections. Each in¬ 
put state pj a , j a E {0z,lz,0x}, is projected into the 
following polarization states: | H) (horizontal), \V) (ver¬ 
tical), | D) (diagonal), and \R) (right-hand circular), and 
counts are accumulated for 10 s for each projective mea¬ 
surement. Density matrices can then be reconstructed 
using the maximum likelihood technique [28]. 


Poz 



FIG. 2. (Color online).Results of quantum state tomogra¬ 
phy. Density matrices are represented by their Stokes param¬ 
eters and plotted on the Poincare sphere. The Stokes pa¬ 
rameters (Si, £ 2 , S 3 ) of the states are: po z (-0.0032 ±0.0042, 
0.0106 ±0.0055, 0.9994 ±0.0002); p lz (-0.0375 ±0.0040, - 
0.0662 ±0.0052, -0.9962 ±0.0005); p 0x (-0.6963 ± 0.0028, 
0.7163 ± 0.0016, -0.0128 ± 0.0029). 

Errors in the quantum state tomography are mostly 
due to the following factors: errors in counting statistics, 
errors in the projection states, and drift of the source’s 
intensity and drift of the input state. We monitor the 
intensity during the experiment, and do not observe sig¬ 
nificant drift in intensity. The drift in input states is 
due to the random unitary transformation induced by 
the short fiber connecting the encoding system and the 
polarization analyzer. We characterize the stability and 
find that the input states remain relatively stable within 
the span of the quantum state tomography measurement. 
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We therefore only consider the first two errors. Errors in 
counting statistics follow the Poisson distribution. Er¬ 
rors in projection states are due to errors in setting 
waveplates’ angles, which follow the Gaussian distribu¬ 
tion with an accuracy of ±0.1°. We use Monte-Carlo 
method [28] to estimate the errors in the density matri¬ 
ces. Additional sets of data are generated numerically 
using the above distributions. Each set of data (consist¬ 
ing of counts and waveplate angles) is used to generate 
a density matrix by the maximum likelihood technique. 
We generate 1,000 additional simulated results for each 
state pj a to get the error distributions of the Stokes pa¬ 
rameters. The reconstructed density matrices together 
with their errors are shown in Fig.2. 

We quantify the overlap between two states pj a 
and by F( p ja , p Sp ) 2 , where F(p ja ,p Sp ) = 

is the fidelity between p ja and 
p S/3 . The overlap between the states po z and pi z is 
F(po z , pi z ) 2 = 0.0024T0.0006 (whereas the ideal overlap 
is 0), and the overlaps between po x and po z , and between 
po x and pi z , are F(po x , po z ) 2 = 0.4994 db 0.0030 and 
F(po z ,pi z ) 2 = 0.4963 zb 0.0028, respectively (whereas 
the ideal overlaps are 0.5). These results are comparable 
to other reported results in commercial [24] and research 
[29] QKD systems. Further details of the state charac¬ 
terization can be found in the Supplemental Material. 

We implement the three state loss-tolerant MDI-QKD 
over 10 km and 40 km of SMF-28 optical fibers. 

In the 10 km demonstration, Alice and Bob are each 
connected to Eve by a 5 km fiber spool. We optimize the 
intensities and probability distributions of the signal and 
decoy states using the model in [25]. The intensity of the 
signal state is chosen to be p = 0.20 photon per pulse, 
and the intensities for the two decoy state are v\ = 0.03 
and v 2 = 0 photon per pulse. The probability to send 
out the signal state p and the decoy states v\ and v 2 are 
= 0.3, P Ul =0.4, and P U2 =0.3, respectively. The 
probabilities to send out the states po z , pi z , and po x are 
Po z = 0.25, P\ z = 0.25, and Pq x = 0.5, respectively. A 
total of N = 6 x 10 11 pulses are sent out. 

The lower bound of the secure key rate is given by [7] 

R > Q^' L [ 1 - h(e%’ u )] - QTf{E^)h(E^), (1) 

where Q^ ,L is the lower bound of the gain of single¬ 
photon states given that both Alice and Bob send out 
signal states p in the Z basis, e^ ,U is the upper bound 
of the phase error rate of single-photon components, Q 
is the gain when both of them send signal states, is 
the quantum bit error rate (QBER) of the signal states 
in the Z basis, f(E^) = 1.16 is the efficiency of error 
correction, and h{pc) = —xlog2(x) — (1 — x)log2(l — x) 
is the Shannon entropy. The values of Q^ and E^ are 
directly measured from the sifted key, and are shown in 
Table I. 

The value of Q^ ,L is estimated using the decoy state 
method [25, 30]. We consider 3 standard deviations of 


statistical fluctuations for finite key analysis, and find 
Q^ l = 3.96 x 1CT 5 . 

With the Stokes parameters of the encoded states, we 
upper bound the phase error rate e]^ ,u = 18.9% using the 
rejected data analysis [21] and the decoy state method. 
We can then lower bound the secure key rate R > 2.48 x 
10 -6 bit per signal pulse. The number of pulses where 
both Alice and Bob send signal states p in the Z basis 
is N = 1.35 x 10 10 , and a private key of length L = 
N^R = 33.8 kbits is generated. 

The high phase error rate is due to the small key size in 
this demonstration. We also estimate the key rate with¬ 
out finite-key correction, as shown in Table I. Besides, 
we perform a proof-of-principle demonstration at 40 km. 
Intensities of the signal and decoy states are the same 
as those in the 10 km demonstration. The key rate is 
estimated without finite-key correction. See Table I for 
details. 

As a comparison, we simulate the performance of MDI- 
QKD with source flaws using the three-state loss-tolerant 
analysis and the GLLP analysis[18, 20]. The result is 
shown in Fig.3, which indicates that no secure key can be 
generated using the GLLP analysis, even for an infinitely 
long key. 

In summary, we have demonstrated the first MDI- 
QKD experiment with an important type of source flaws 
taken into consideration. In contrast to previous demon¬ 
strations which assume perfect state modulations with¬ 
out verification, our experiment shows the feasibility of 
generating secure keys with imperfect states prepared by 
off-the-shelf devices. The methodology developed here 
can be applied to high speed systems [15] and in a net¬ 
work setting [14]. In future, it will be intersting to con¬ 
sider other source flaws in MDI-QKD, for example, im¬ 
perfect phase randomizations [26]. 

We thank F. Xu, E. Zhu, and M. Curty for enlightening 
discussions. Financial support from NSERC Discovery 
Grant, NSERC RTI Grant, and the Canada Research 
Chairs Program is gratefully acknowledged. 

SUPPLEMENTAL MATERIAL 

Upper-bounding phase error rate by rejected data 
analysis 

In this section, we give the algorithm used in the Letter 
to estimate the phase error rate e ^ using the rejected 
data analysis as proposed in [21]. 

In the actual three-state MDI-QKD protocol, Alice and 
Bob send the untrusted third party Eve photons encoded 
in one of the three polarization states. Let | 4>j a )A e E be 
the purification of the state pE,j a sent by Alice to Eve, 
where j a G {0z,lz>0x} 5 and the subscripts A e and E 
represent the extended system possessed by Alice and the 
system to be sent to Eve, respectively. Sending the state 
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TABLE I. Key rate for loss-tolerant MDI-QKD at 10 km and 40 km. An infinitely long key (oo in data size) indicates that finite 
key effect is not considered when estimating the key rate R. The inefficiency of error correction is chosen to be f(E z ^) = 1.16. 


Distance 

Data size 

Security bound 

Qii L 

XE 

e n 

O z 

E. 

R (bit per pulse) 

10 km 

6 x 10 11 

10 -3 

3.96 x 10“ 5 

0.189 

6.31 x 10“ 5 

0.0178 

2.48 x 10 -6 

10 km 

OO 

N/A 

4.17 x 10“ 5 

0.079 

6.31 x 10“ 5 

0.0178 

1.57 x 10 _5 

40 km 

OO 

N/A 

1.88 x 10 -5 

0.122 

2.94 x 10“ 5 

0.0368 

1.00 x 10“ 6 


Loss tolerant MDI-QKD 




FIG. 3. (Color online). The upper figure shows the simu¬ 
lated and experimental key rates of the loss-tolerant MDI- 
QKD protocol, for both the infinitely long key case and the 
finite-key case. We use £ to quantify the relative modula¬ 
tion error. See Supplemental Material for the exact defi¬ 
nition of 5. The modulation error 5 = 0.1 corresponds to 
F(po z i pi z ) = 0.0025, which is close to our experimental 
value. The lower figure shows the simulated key rates for 
an infinitely long key under the GLLP analysis. The results 
show that the loss-tolerant protocol gives a positive key rate 
for realistic values of encoding flaws, while no key can be 
generated with the GLLP proof. We use our experimental 
parameters for simulation. 


B , B e , and E' , 

\®)BB e E> = ~^(\0z) b\4>0 z )B e E' + \lz) b\4>1z)B e E'), ( 3 ) 

followed by a projective measurement on system B in 
the Z basis with outcome 0 (1), and sending system E' 
to Eve. 

Now consider the following virtual protocol. Alice pre¬ 
pares the state \^)aa g e^ measures system A in the X 
basis with outcome j G {0,1}, and sends Eve the system 
E. The state sent to Eve can be written as 

&% x =TrAA e [P(\jxU)lA B EPmAA'E)], (4) 

where P(x) = \x)(x\, and \j x ) = l/v / 2(|0z) + (-l) J \lz))- 
Similarly, Bob prepares the state | ^)bb g e, measures sys¬ 
tem B in the X basis with outcome s G {0,1}, and sends 
Eve the system E' whose state is given by 

° V E\sx = Tr B B e [P(\ s x)B)^B e E'P(\^)BB e E')}, (5) 

where |s x ) = l/\/2(|0 z ) + (-l) s |l z )). 

The phase error rate of single photon components is de¬ 
termined by the transmission rates of the fictitious states: 

,vir , ,vir 

gll _ _ ' IxOx _ /gh 

X ,vir - t / r'fr+,vir , t , t ,vir ’ ' ' 

Y 0 x 0x + Y lxlx + Y 0xlx + r K0x 

where Yj xSx is the probability that Alice and Bob send 
Eve the virtual states <JE,j x an d &E',s x , respectively, and 
Eve gets a successful Bell state measurement with out¬ 
come |4/ + ) = (\H)\V) + \ V)\H))/y/2, which is given by 


Pe,o z {pE,i z ) to E ve by Alice is equivalent to preparing 
the tripartite state of systems A , A e , E 


\^)aa b e 


1 

A 


(\0z)A\4>O z )A e E + \^-z) A^lz) A e E) 


( 2 ) 


= Tr[al%}Tr[alX Sx }Tr[D^a' EJ 


Jxs x 


Jx 


E',s x J* 


( 7 ) 

In the above equation, the operator D^+ is Eve’s oper¬ 
ation corresponding to the BSM with outcome \h + , and 


the operators ct'ej x an d E',j x are the normalized ver¬ 
sions of r - x and gi ven by 


followed by a projective measurement on system A in the 
Z basis with an outcome of 0 (1), and sending system E 
to Eve. 

Likewise, sending po z (pi z ) to Eve by Bob is equivalent 
to preparing the tripartite state | ^)bb g e' with systems 


( 8 ) 


The density operators of the virtual states b v ej x and 
b v ^Ts x can be found from the density operators of the 
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actual states pj a . From Eqs. (2) and (4), the virtual 
state (Jej x sent to Eve by Alice is 

=Tr AAe [P{\j X )A)lA e EpmAA e E)] 

= ^[(PE,o z + pE Az ) + {-l) J Tr Ae {\(j) lz ) Ae E{(t>o z \A e E 
+ \(/>O z )A e E((l>lz\A e E)\- 

(9) 

Let |t j a )E and \jj a )E be the eigenvectors of PE,j a , and 
| A % j a \ 2 and |A^ -J 2 be the corresponding eigenvalues. 
The Schmidt decomposition of | <t>j a )A e E is 

PjP)A e E = ^EjJ^AehjjE + ^EjJpAehjjE (10) 


The density operator o v eP S x (the virtual state sent to 
Eve by Bob) can be found using the same method. 

We first discuss the case where the states lie in the 
X — Z plane. In this case, the Stokes parameter S Y = 0, 
and the states cr'^j x (with Stokes parameters [S v ^ r -^ y 
0, S V E V j x ) and o' E ', Sx (w^h Stokes parameters {S v ^ r -^ , 
0, S V £ r -Z ) can be written as a linear combination of the 
identity matrix <tj and the Pauli matrices &x , &z • 

^, v ^ r 1 /a . nvir,X ~ . nvir,Z ~ \ /-. 0 \ 

a EJ X = 2 1 W + ^,jx + ^,/x ^ ( 12 ) 


where {|0 )a 6 |1)a 6 } i s a basis of Alice’s extended system 
A e . Note that since Alice possesses the extended system 
A e , she can select the basis {|0)^ e |1 )a £ } in the purifi¬ 
cation of pE,j a to optimize the key rate. In this paper, 
we use the same basis {|0 )a 6 |1)a 6 } for the purification 
of Pe,o z an( l PE,izi which is not necessarily the optimal 
choice. The key rate can be further improved by opti¬ 
mizing the purification, which is left as future work. 

Substituting Eq. (10) into (9), the virtual state <? v ej x 
is 


a 1 


E',sx 


= l(A + S™f A x + St: s Z Az) (13) 


Define the transmission rate of £, t' G {/, X, Z} 

as 


^Ejx = |((Ae:,o z + Pe,i z ) 

+ (-l) j [A° e ,o z A 0 s , 1z (|7o 0 z ) B (7i° z | S + |7 i z )b(7o z |b) 

+ At,o z Ab,i z (|7o z )e(7i z |e + |7i z )b(7o z U)]}- 

( 11 ) 


q*+\t,t> = -Tr[Dy+a t ®i%>}. 


(14) 


From Eqs. (7) and (14), the transmission rate Y^ s 
can be written as 


Y 


z^ + ,vir m \^vir irr \^vir s' , nvir,X . nvir,Z 

ixsx - Tr Y 7 E,ix\ Tr \?E',8x\ x Wtf+I j®j + S E ',s x qy+ \I®X + S E , tSx q^+\i^z 

, nvir,X , nvir,X nvir,X , nvir,X Qvir,Z 

+ b E,j x X®/ + * E,j x VE',s x q * + \ x ® x + b E,j x *£' )Sx , ?«-+|X®Z 

. qvir,Z 7 X 7 . 7 . 




(15) 


Let S7 11 ! be a row vector and q be a column vector defined as 

1 X Sx ^ 


i vir 
‘jxsx 


[l,S v E ir ’ X 


J E',sx ’ 


qvir,Z 

b E\s x 


nvir,X qvir,X qvir,X 

^E,j x ’ ^E,j x ^E' t s x 


qvir,X qvir,Z qvir,Z qvir,Z qvir,X 

^E,j x ^E',s x 5 ^E,j x ’ ^E,j x D E' t s x 


qvir,Z qvir,Z i 

^E,j x ^E',sx J’ 


(16) 


q— fe+|/07 , ^+|70Xj (fo+|70Zj ^+|X07 j ^+|X 0 Xj (fo+|X0Z> Q^\Z®X j ^+|Z(g)z] T ; 


(17) 


respectively. The expression for the transmission rate 
^ - (^T (15)) can be written as 


,vir _ 

1 3 xs x 


= Tr[c 


E,jx 




Once we know the transmission rates of the Pauli matri¬ 
ces q, we can estimate Y^ xSx ir and the phase error rate 
e^. In the next session, we will discuss how to find q 
from experimental data. 

When the states pE,j a prepared by Alice / Bob do not 


(18) 
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lie in the X — Z plane, we can always find a reference 
frame such that the states Pe,o z , Pe, i zj and Pe,o x ^ ave 
a common Stokes parameter S^ (i.e., the Stokes param¬ 
eters of the state PE,j a is given by - q , S^, &e j a ) m ) 
We apply the filtering technique described in [21], which 
shows that, for a state pE,j a with a nonzero S^, we can 
equivalently consider the following state with its Stokes 
parameters given by, 


qX OZ 

1 m 1 ’ /(«) j 


(19) 


where f(q ) is given by 


m = 


2(1 ~q)q 

1-2 q + 2 q 2 


( 20 ) 


Recall in the three-state MDI-QKD, Alice (Bob) ran¬ 
domly sends Eve one of the three states Pe,o z (. Pe',o z ), 
Pe, lz {PE',1 Z ), pE, Ox (pE', Ox)- As in tlie previous sec¬ 
tion, the subscripts E and E' represent the systems sent 
to Eve by Alice and Bob, respectively. 

Let Yj^gp 11 be the conditional probability that Eve gets 
a successful Bell state measurement with outcome 
given that Alice sends Eve a single photon of state pE,j a 
and Bob sends Eve a single photon of state Pe',s p (the su¬ 
perscript 11 represent that both Alice and Bob send out 
single photons). Following the procedures described in 
the previous section, the transmission rate of the actual 
states Yf c ,n can be written as 

Jot 


and q is determined by solving the following equation 


(gg -1) 

(1 — 2q + 2q 2 )' 


( 21 ) 


Y j a Sf, ~ *Jo 


( 22 ) 


Estimating transmission rates of Pauli matrices from 
experimental data 

In this section, we will show how to estimate the trans¬ 
mission rates of Pauli matrices q from experimental data. 


where Sj aS/3 is related to the actual states pE,j a (with 
Stokes parameters 0, SEj a ) an d PE',sp (with 

Stokes parameters Sbeta , 0, S§, ) as follows: 


S.i, 


s /3 


[1? Se', S/3 i SE',spi 


^E,j a 7 


nX nX nX qZ nZ 

^Eja^E' ,sp 5 ^EJa^E' ,sp J ^EJ a i 


qZ qX 

&E,j a &E' ,Sp 5 


qZ qZ 
^E,j a ^E' 


> S P ■ 


(23) 


From experiment, we can get the following set of inde¬ 
pendent linear equations: 


v ^+,n 

^o z o z 

v *+,n 

I 0 Z 1 Z 

yV+,11 

X lzO z 

v v+,n 

I lzlz 

V H+,11 

X 0 X 0 Z 

v f+,u 
1 Ox lz 

v 3-+,u 

^0 z 0x 

v 3-+,u 

IzOx 

v ^+,n 

Y 0 x 0x 

Define a vector Y^’ 11 


— SozOz^ 
= Sozlz^ 
^lzOzQ? 
^lzlz^T 
^OxOz*L 

= S 0x i z q, 
= SozOxB- 

= Si z0x q. 
= SoxOxQ- 


(24) 


v ^+,ll _ r v ^ + d 1 V^ + ’ n V^ + ’ n V^ + ’ n 
1 — [ X 0 Z 0 z ^ 1 0 z l z ? 1 1 Z 0 Z > x l z l z > 

v ^+,ll V V + ,11 v ^+,ll v ^ + ,ll 
0x0 z ’ Oxlz 5 0z0x 5 IzOx 5 0x0x J 


( 25 ) 


and a matrix $ 

^OzOz 
^Oz lz 
^lzOz 
^lzlz 

s= S 0x0z 

S O x lz 

So z Ox 

S lzO x 

-^O x Ox- 

The linear system (24) can be concisely written as 

Y^’ 11 = Sq. (26) 

Knowing Y^’ 11 from the experiment, the transmis¬ 
sion rates q can be solved: 

q = $- 1 Y* + ’ 11 . (27) 

The transmission rates of the virtual states can then 
be calculated by Eq.(18), and the phase error rate can 
be estimated by Eq.(6). 










Bounding with a finite number of decoy states 

In the previous two sections, we give the method to 
estimate the phase error rate e 1 ^ from the ,n , which 
is the yield of single photon components. The param¬ 
eter can be precisely estimated with an infinite 

number of decoy states. 

In reality, we can only apply a finite number of decoy 
states, where the value of Y^ s ^ 11 can not be precisely de¬ 
termined. Instead, we can find an upper bound Y? ,11,t7 

and a lower bound Y ^ 3 ’ 11,L , either analytically [25? ] or 
by linear programming. In this case, the linear system 
(24, 26) should be replaced with the following linear in¬ 
equality: 

Y*+,h,l < Sq < y^ + 11u . (28) 

where 


Similarly, upper bounding Y^f^ r + Y^f Q : ^ ir is equiv¬ 
alent to the following linear programming problem: 

max{ (T r [a v E " 0 }Tr [a^ ] 

9 (34) 

+ Tr[a| i y]Tr[a^ 0 JS™ 0x )q} 

subject to the constraint (28). 

State Characterization 

In this session, we discuss the sources of errors involved 
in preparing the BB84 states, and how we minimize the 
state preparation errors. We then present the details of 
state characterization using quantum state tomography. 

Sources of encoding errors 


^\I>+ ,11,L , 11, L 11,Z/ 111, L , 11, L 

1 - l r 0 z 0 z ’ r 0 z lz ’ r lzO z > r l z l z > 

V v + ,11,L y^+,11 ,L V & + ,11,L V ^ + ,11,L y^+,ll,L] 

0x0 z 5 Oxl z 5 0 z 0x 5 l^Ox 5 OxOx b 

(29) 

and 


v ^+,ll,U _ r v ^ + ,ll ,U v ^ + ,ll ,U V ^+,11,C/ v ^ + ,ll ,U 

1 — l Y 0 z 0 z > Y 0 Z 1 Z ’ Y lzO z > Y l z l z > 

v ^+,ll ,U v ^+,ll ,U v ^+,ll ,U v ^+,ll ,U 

OxOx 5 Oxlz 5 0 z 0x 5 l^Ox 5 OxOx b 

(3°) 

Our task is to find an upper bound of the phase error 
rate e^. The expression of e ^ (Eq. 6) can be rewritten 
as 


e x = -z-+-• (31) 

l I r 0x0x +r ixix 

' y^+ ,vir ly^ - ^ ,vir 

r o x ix +r i x 0x 


The upper bound of e % found by lower bounding 




0x0a 


r i ,vir i i v t .vir , 

+ Y 1 X 1 X and u PP er bounding Y 0 { +Yi 0 ’ 


vir m 

xux ‘ 


°x < ex’ U = 


1 + 


w 




r +n 




(*i 


, 


r y^+,z 


(32) 


Finding a lower bound of M ir 

'-'X '-'X A - 1- A 

lent to the following linear programming problem: 


i ,vir - 

+ Y lx f x is equiva- 


rmn 

q 


in{ (Tr [a v E " 0x } Tr [a v E T 0x ] Sj 


vir 

OxOx 


+ Tr[atijTr[*lV 1 JS™ lx ) q } 


(33) 


Fig. 4 shows the schematic of the bi-directional po¬ 
larization modulator [27]. Optical pulses are launched 
through an optical circulator to a phase modulator (PM). 
The polarization of the light is at 45° to the TE axis of 
the LiNbOs waveguide inside the PM. When an optical 
pulse travels through the PM for the first time, a positive 
voltage +V is applied on the phase modulator. The pulse 
is reflected by a Faraday mirror (FM) with its polariza¬ 
tion rotated by 90°, and travels back. When the pulse 
travels through the PM for the second time, a negative 
voltage — V is applied on the PM. Due to the different 
modulation efficiency in the TE and TM modes, we intro¬ 
duce a phase difference along the TE and TM directions. 
The output state can be expressed as 


\TE) + e l v\TM) 

71 ' 


(35) 


where | TE) and | TM) represent the polarization states 
along the TE and TM directions of the PM’s waveguide, 
and ip is the phase difference introduced, which depends 
on the applied voltage. By modulating ip to {0, 7 r, 7t/2}, 
we can generate the three states {po z , pi z , pox} needed 
in our protocol. 

Here we discuss the sources of errors in the encoding 
system that lead to imperfect state preparations. 

Power mismatch in TE and TM modes Ideally we want 
optical pulses to be launched into the PM at an angle of 
45° relative to the TE axis of the PM’s waveguide. Is 
this case, the powers along the TE and TM directions are 
equal, and the output states {po z , Pi Z j Po x } are located 
on a great circle on the Poincare sphere. However, optical 
pulses may be launched at an angle k other than 45°. 
In this case, the modulated output state 35 should be 
rewritten as 


IV’) = cos(k)\TE) + sin{K)e^\TM). (36) 


subject to the constraint given by inequality (28). 
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As a result, the output states { po z , pi z , po x } are 
distributed on a small circle on the Poincare sphere. 
In this case, po z and p\ z are no longer orthogonal, 
and their overlap (characterized by F(po z , po z ) 2 , where 
F(po z , po z ) is the fidelity between po z and pi z ) is 
cos 2 (2 k). This is the dominant error that lead to modu¬ 
lation errors in our encoding system. 

Control voltage accuracy The accuracy is limited by 
the voltage resolution of the signal source driving the 
PM. In our experiment, the waveform generator driving 
the PM has an output amplitude of ±5 V and a resolution 
of 1 mV. The of the PM is around 5 V, which means 
that error due to limited resolution of the driving voltage 
is relatively small. 

To minimize the errors in the state preparation, we 
finely scan the voltage applied on the phase modulator 
at a step of 0.02 V and characterize the corresponding 
output states. The step size of 0.02 V guarantees that 
the error due to voltage accuracy is less than 0.4%. Fig. 
5 shows different states corresponding to different volt¬ 
ages applied on the polarization modulator. po z corre¬ 
sponds to the state when the applied voltage is 0 V. We 
search around 2.5 V and 5.0 V at a step size of 0.02 V to 
search the states po x and pi z with minimum encoding 
errors. Each point on the Poincare sphere corresponds 
one applied voltage. The states are reconstructed using 
quantum state tomography, as discussed in the next sec¬ 
tion. Fig. 6 shows the overlap between po z and po x > an d 
the overlap between po z and pi z , with different voltages. 
The voltage for po x is chosen such that the overlap be¬ 
tween po z and po x is as close to 0.5 as possible, and the 
voltage for pi z is chosen such that the overlap between 
po z and pi z is minimized. 


Quantum state tomography 

Fig. 7 shows the setup of the quantum state tomogra¬ 
phy experiment. Optical pulses encoded in the polariza- 



FIG. 4. (Color online). Schematic of the polarization modu¬ 
lator. 


tion state where j a G {0z,lz,0x}, are sent to the 
electrical polarization controller for projective measure¬ 
ments. The projective state |^) is given by 

I'*/’) = uI I wp(0)Uqwp( ( I ) )\H)- (37) 

The operations Uhwp{&) and Uqwp (</>) are the unitary 
transformations by a half wave plate (HWP) and a quar¬ 
ter wave plate (QWP) with fast axes set to 0 and 0, 
respectively, which are given by 


Uhwp(0 ) 


cos(26) sin(20) 

sin(20) —cos(26) 


Uqwp{0) 


cos 2 {(j)) + isin 2 ^) (1 — i)cos(</>)sm(</>) 
(1 — i)cos{<j))sin{(j)) sin 2 (</>) + icos 2 (q i>) 


In the tomography experiment, each state pj a is pro¬ 
jected into the following four polarization basis states: 
horizontal |i7), vertical |V), diagonal \D), and right-hand 
circular | R). The settings of the HWP, QWP, and POL 
are summarized in Table II. Photons are detected by a 
single photon detector (SPD1). Another single photon 
detector (SPD2) is used to monitor the total intensity of 
the incoming light pulses. The data acquisition time for 
each projective measurement is t — 10 s, and the counts 
are summarized in Table III. 

Below we describe the procedures to reconstruct the 
density matrices from the data in Table III (see next sec¬ 
tion) using the maximum likelihood technique [28]. For 



FIG. 5. (Color online). Search of the states with minimum 
encoding errors. We scan the voltages applied on the polariza¬ 
tion modulator to find the states po x and pi z with minimum 
modulation errors. 
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FIG. 6. (Color online). Overlap between p 0z and po x , and 
overlap between po z and pi z , with different voltages applied 
on the Pol-M. The voltage for po x is chosen to get the overlap 
between po z and po x as close to 0.5 as possible, and the 
voltage for p\ z is chosen such that the overlap between po z 
and pi z is minimized. 


each projective measurement, counts detected by SPD 1 
are accumulated for 10s, and the results are shown in Ta¬ 
ble I of the main text. The total counts corresponding to 
the projective measurement to | H), \V), \D), and | R) are 
denoted as n#, ny, and tlr , respectively. We first 
calculate a normalized count rate G {H, V, D, R} 

to correct the impacts of dark counts and deadtime: 


= —^- DC 

t 


(38) 


where £ = 10 s is the data acquisition time, r = 10 ps 
is the detector deadtime, and DC = 50 Hz is the dark 
count rate. Note that in the above expression, the term 
( t—n^r) gives the total active time of the detector during 
£, and gives the counting rate per unit active time. 

The density matrix to be reconstructed can be written 
as 


Pi, 


To 


J 


(39) 


where Tj a is the conjugate transpose of Tj a , and Tj a is 


Encoding 

system 


50/50 BS 


SPD2 


SPD1 


Electrical Polarization 
Controller 


Tj = 

Jot 


t\ 0 
£3 + U4 £2 


The values of £ 1 , £ 2 , £ 3 , and £4 are determined numer¬ 
ically by minimizing the following likelihood function: 


l(£i, £ 2 , £ 3 , £ 4 ) — 

/ ij>=H,V,D,R 


[ N (’*P\pj a (ti,t2,t 3 ,t4)\'<p) -n^,] 2 
2N(lp\p ja (il, *2, *3, *4>|‘0> 
(40) 


where N = hn + fly. 

To estimate the error distributions, we use Monte 
Carlo simulations to numerically generate additional 
data based on the experimental data and errors in the 
setup. As discussed in the Letter, the intensity and in¬ 
put polarization states are relatively stable and no drifts 
are observed within the span of the tomography measure¬ 
ment. See Fig. and its caption for details. 

We therefore consider two sources of errors: errors in 
counting statistics and errors in the angles of waveplates. 
To simulate the errors in we assume the detection 
counts follow the Poisson distribution. In the simulation, 
a random number n is generated from the Poisson 
distribution with mean given by the experimental value 
n^ as an input to the maximum likelihood algorithm. 

Errors in setting waveplates’ angles lead to projec¬ 
tion to a state other than the one intended. Our elec¬ 
trical polarization controller has a accuracy of ± 0 . 1 ° 
(0.00175 rad) in waveplate angle settings. To model er¬ 
rors in waveplate angles 0 and </>, random variables 6 sim 
and are generated from the normal distributions 

£V(0,0.00175 2 ) and £V(</>, 0.00175 2 ), respectively, where 
0 and (p are the intended angle settings, and N((x,a 2 ) 
is the Gaussian distribution with mean x and variance 
a 2 . The state projected into is given by |^ sirn ) = 
UHWp(0 Sim )UQWp( < fi Sim )\H)i where | H) is the horizon¬ 
tal state given by | H) = [1,0] T . 

In each round of simulation, a set of data, including 
n s«m, Qsim ^ an q ^sim ^ are numerically generated using 
the distributions described above, and are used to cal¬ 
culate a density matrix using the maximum likelihood 
method. For each state pj a , a total of 1 x 10 3 sets of 


TABLE II. Angles of waveplates and polarizer angles for 
quantum state tomography. 


Projective state 

HWP 

QWP 

POL 

1 H) 

0° 

0° 

0° 

\V) 

45° 

0° 

0° 

1 D) 

22.5° 

0° 

0° 

1 R) 

0° 

45° 

0° 


FIG. 7. (Color online). Schematic of the quantum state to¬ 
mography setup. HWP: half wave plate; QWP, quarter wave 
plate; POL: polarizer; SPD, single photon detector. 
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10 km loss tolerant MDI-QKD 
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FIG. 8. (Color online). Stability of intensities and input 
states during the quantum state tomography. The upper fig¬ 
ure shows the optical power coming out of the encoding sys¬ 
tem (intensity was not attenuated to single photon level in 
this measurement). The lower figure shows the stability test 
of the input polarization states. Horizontally polarized light 
coming out of the encoding system is measured at the H/V 
basis by a polarizing beam splitter. The figure shows the ex¬ 
tinction ratio (i.e., the ratio of the power at the H and V 
output ports), which is around 35 dB over a period of 1200 s. 
The results show that the intensities and polarization states 
remain stable within the span of the tomography experiment 
(< 5 minutes). 


data are simulated to give the error distribution of the 
density matrix constructed. 


Experimental results 


We preformed the loss tolerant MDI-QKD experiment 
over 10 km and 40 km of optical fibers. The detailed 
experimental data is presented below. 


TABLE III. Raw counts in the quantum state tomography 
experiment. Counts are accumulated for 10 s. 


State 

1 H) 

Projected states 

IV 1 D) 

1 R) 

Po z 

201311 

583 

112867 

114043 

P^z 

982 

203500 

122028 

110687 

POx 

114815 

117459 

35646 

38239 


In this section, we present detailed experimental re¬ 
sults not covered in the main text. 

In the 10 km demonstration, we send a total of 6 x 10 11 
pulses. The probabilities of sending p 0z , pi zl and po x are 
Po z = 0.25, P\ z = 0.25, and P 0x = 0-5. The intensities 
of the signal state is p = 0.2 photon per pulse, and the 
intensities of the decoy states are v\ = 0.03 and v<i = 0 
photon per pulse. 

Table IV shows Q^ s ’^ a7jB , the conditional probability 
that Eve gets a successful Bell state measurement with 
outcome T + given that Alice sends out a pulse of inten¬ 
sity I a in the state pj a and Bob sends out a pulse of 
intensity I E in the state p S/3 . 

The upper and lower bounds of the yields of single pho¬ 
ton components are estimated given the following 

constraint [30]: 


n *+,i A i B 

^jcxS/3 


( 1 - 


k 


n IaIb 

3 cxS/3 


Ja Ib 


) 


oo 

* E 


t m t n 

-Ia-Ib ±A ±b y^ + ,mn 

m\n\ i aS/3 


m,n =0 




< 


,Ia Ib , 

^3 ocSp 


(1 + 


IaIb ’IaIb 


N iPs«Q 


JcxSp ^JcxS/3 


(41) 


where is the conditional probability that Eve 

gets a BSM outcome T + given that Alice sends a pulse 
of m photons in the state pj a and Bob sends a pulse of 
n photons in the state p S/3 , and is the number of 

pulses where Alice sends the state pj a with intensity I a 
and Bob sends the state p Sp with intensity /#, and k is 
the number of standard deviations, which is chosen to be 
k = 3. 

An upper bound and a lower bound of Y^ s ^ 11 are es¬ 
timated from the constraint in Eq. (41) using linear pro¬ 
gramming, and the results are presented in Table V. 

We can now find an upper bound of the phase error 
rate by solving the linear programming problems in 
(33) and (34), where the coefficients of the linear system 
are given by the Stokes parameters of the actual encoded 
states p EJa and p E ',sp, j a , $(3 € {0z, lz, Ox}- We search 
in the sets of states generated by Monte-Carlo simulation 
and select the one that maximizes = 18.9%, which is 
4 standard deviations from the mean. 

This high phase error rate is mostly due to the small 
key size. As a comparison, we also estimate assuming 
we have an infinitely long key. That is, we take = 

oc when bounding Y^ s ’ n , and the results are shown in 
Table VI. The tighter bounds of lead to an upper 

bound e 1 ^ = 7.9%. 
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40 km loss tolerant MDI-QKD 

We perform a demonstration of loss tolerant MDI- 
QKD over 40 km of optical fiber. The parameters (in¬ 
tensities and probability distributions of signal and de¬ 
coy states) used are the same as those used in the 10 km 
demonstration. Table VII shows the values of the gains 
Qj a sp AlB • The u PP er and lower bounds of the yields 

of single photon components Y^ s ^ 11 estimated using the 
constraints in (41) are shown in Table VIII. As a proof- 
of-principle demonstration, we do not consider finite key 
effect when bounding Y^ s . Using the same algorithm, 
an upper bound of ex is found to be 12.2%, and the key 
rate is R = 1 x 10 -6 bit per pulse. 


MDI-QKD UNDER THE GLLP Analysis 


In this section we show how the key rate under the 
GLLP analysis is simulated. For simplicity, we assume 
that the states prepared by Alice and Bob to be identical 
in the GLLP simulation. We use the error preparation 
flaw model in [21]. The four BB84 states with prepara¬ 
tion flaws S are given by 


100 z ) = 1 ° z) 

5 $ 

101 z ) = -sin-\0z) + cos-\lz) 

I0o x > = cos(| + |)|0 Z > + sin(^ + ^)|l z ) 

I0ix> = cos (~\ + j)|0z> + sin(~ + ^)|1 z) 

where |0 z) and |1 z) are the perfect horizontal and verti¬ 
cal states (i.e., (0^|lz) — 0). 

Under the GLLP analysis, the imbalance of the quan¬ 
tum coin A i n i is defined as 

Aini = -[1 — F(p x , Pz)F{px, Pz)\i ( 43 ) 


where p x ^ an d Pz^ are the density matrices of states 
in the X and Z bases prepared by Alice (Bob). The 
pessimistic assumption of GLLP assumes that Eve can 
enhance the imbalance of the quantum coin through the 
loss of single-photon components. As a result, the upper 
bound of the imbalance A is given by 


A < 


A ini 

y^+,ll 


(44) 


where Y^’ 11 is the yield of single photons. The phase 
error rate e' x is related to A by [21] 


TV < V^ + 2\/A( x /(l - A)(l - e x ) ~ V&C) (45) 


where ex is the bit error rate in the X basis, which can 
be measured directly from the sifted key. In the presence 
of basis-dependent flaws (A^ % 0), A increases dramat¬ 
ically as the distance increases, leading to a very poor 
estimation of the phase error rate e! x . 
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TABLE V. Lower bounds (Y^'^ 11,L ) an d npper bounds (Y^^ 11,t7 ) °f in the 10 km experiment. These bounds are 

estimated assuming 3 standard deviations of statistical fluctuations for finite key analysis. 


ja.S/3 

OzOz 

Ozlz 

IzOz 

lzlz OxOz 

Oxlz 

OzOx 

IzOx 

Ox Ox 

yT, 11,L 

^ S P 

0 

2.92 x 10 -3 

2.97 x 10“ 3 

0 1.47 x 10“ 3 

1.44 x 10 -3 

1.42 x 10“ 3 

1.17 x 10 -3 

2.98 x 10 -3 

yV + ,ll,U 

1 3 otsp 

5.64 x 10 -5 

3.41 x 10“ 3 

3.47 x 10“ 3 

6.41 x 10“ 5 1.86 x 10“ 3 

1.78 x 10 -3 

1.78 x 10“ 3 

1.54 x 10“ 3 

3.41 x 10“ 3 


TABLE VI. Lower bounds (Y^~^ 11,jL ) an d npper bounds (Y^^ 11,c/ ) °f ^j^s'p 1 in the 10 km experiment. These bounds are 
estimated assuming an infinitely long key. 


jct s (3 

OzOz 

Ozlz 

IzOz 

lzlz 

0x0z 

Oxlz 

0z0x 

IzOx 

Ox Ox 

T^ + , 11,L 

1 3 ocsp 

4.12 x 10“ 6 

3.08 x 10“ 3 

3.14 x 10“ 3 

2.6 x 10 -14 

1.62 x 10“ 3 

1.59 x 10 -3 

1.56 x 10“ 3 

1.31 x 10 -3 

3.13 x 10“ 3 

yV+,ll,U 

1 JaSp 

1.77 x 10“ 5 

3.31 x 10 -3 

3.35 x 10“ 3 

1.18 x 10 -5 

1.76 x 10“ 3 

1.69 x 10 -3 

1.69 x 10“ 3 

1.45 x 10 -3 

3.31 x 10 -3 


TABLE VII. Experimental values of Qj^tp (conditional probability that Eve gets a successful Bell state measurement with 

outcome T + given that Alice sends pj a with intensity I a and Bob sends p S/3 with intensity Is) in the 40 km MDI-QKD 
experiment. 


State 








Intensities IaIb 








jet S/3 

^2^2 

1S 2 1Sl 

V2P 

V 1 V 2 

VlVl 

V\P 

PV2 

pv\ 

Ml 

OzOz 

0 


(5.31 ± 

0.98) 

(4.90 ± 

0.31) 

(5.48 ± 

1.03) 

(1.00 ±0.12) 

(5.97 ± 

0.43) 

(5.87 ± 

0.48) 

(6.57 ± 

0.35) 

(1.28 ± 

0.07) 




xlO 

-8 

xlO 

-7 

xlO 

-8 

XlO -7 

xlO 

-7 

xlO 

-7 

xlO 

-7 

xlO 

-6 

Ozlz 

(2.65 ± 

2.65) (3.98 ± 

1.03) 

(5.60 ± 

0.39) 

(5.73 ± 

1.15) 

(1.47 ±0.04) 

(9.55 ± 

0.15) 

(7.06 ± 

0.43) 

(8.77 ± 

0.16) 

(5.63 ± 

0.04) 


xlO' 

-9 

xlO 

-8 

xlO 

-7 

xlO 

-8 

xlO -6 

xlO 

-6 

xlO 

-7 

xlO 

-6 

xlO 

-5 

0z0x 

(1.51 ± 

1.51) (2.93 ± 

0.16) 

(1.22 ± 

0.01) 

(5.59 ± 

0.72) 

(1.02 ±0.03) 

(1.64 ± 

0.01) 

(5.32 ± 

0.27) 

(4.76 ± 

0.07) 

(4.02 ± 

0.02) 


xlO' 

-9 

xlO 

-7 

xlO 

-5 

xlO 

-8 

xlO -6 

xlO 

-5 

xlO 

-7 

xlO 

-6 

xlO 

-5 

IzOz 

(5.11 ± 

3.61) (3.91 ± 

0.95) 

(5.89 ± 

0.38) 

(5.72 ± 

1.01) 

(1.28 ±0.05) 

(8.88 ± 

0.13) 

(1.20 ± 

0.05) 

(9.28 ± 

0.14) 

(5.71 ± 

0.04) 


xlO' 

-9 

xlO 

-8 

xlO 

-7 

xlO 

-8 

xlO -6 

xlO 

-6 

xlO 

-6 

xlO 

-6 

xlO 

-5 

lzlz 

0 


(4.13 ± 

1.03) 

(4.55 ± 

0.37) 

(8.92 ± 

1.41) 

(1.42 ±0.15) 

(8.08 ± 

0.51) 

(1.15 ± 

0.05) 

(1.39 ± 

0.05) 

(3.05 ± 

0.09) 




xlO 

-8 

xlO 

-7 

xlO 

-8 

xlO -7 

xlO 

-7 

xlO 

-6 

xlO 

-6 

xlO 

-6 

IzOx 

0 


(2.94 ± 

0.17) 

(1.27 ± 

0.01) 

(8.32 ± 

0.91) 

(9.02 ± 0.28) 

(1.56 ± 

0.01) 

(1.29 ± 

0.04) 

(4.81 ± 

0.07) 

(3.40 ± 

0.02) 




xlO 

-7 

xlO 

-5 

xlO 

-8 

xlO -7 

xlO' 

-5 

xlO' 

-6 

xlO' 

-6 

xlO' 

-5 

OxOz 

(4.81 ± 

2.40) (6.07 ± 

0.75) 

(5.67 ± 

0.26) 

(4.77 ± 

0.24) 

(1.19 ±0.03) 

(5.60 ± 

0.08) 

(1.63 ± 

0.01) 

(2.06 ± 

0.02) 

(4.68 ± 

0.03) 


xlO' 

-9 

xlO 

-8 

xlO 

-7 

xlO 

-7 

xlO -6 

xlO' 

-6 

xlO 

-5 

xlO 

-5 

xlO' 

-5 

Oxlz 

(1.51 ± 

1.51) (5.54 ± 

0.78) 

(5.30 ± 

0.27) 

(4.35 ± 

0.21) 

(1.15 ±0.03) 

(5.05 ± 

0.07) 

(1.63 ± 

0.02) 

(1.98 ± 

0.01) 

(41.3 ± 

0.02) 


xlO" 

-9 

xlO 

-8 

xlO 

-7 

xlO 

-7 

xlO -6 

xlO' 

-6 

xlO' 

-5 

xlO' 

-5 

xlO 

-5 

OxOx 

(2.19 ± 

1.26) (3.12 ± 

0.14) 

(1.21 ± 

0.01) 

(4.15 ± 

0.15) 

(1.99 ±0.03) 

(2.06 ± 

0.01) 

(1.60 ± 

0.01) 

(2.45 ± 

0.01) 

(8.04 ± 

0.02) 


xlO" 

-9 

xlO 

-7 

xlO 

-5 

xlO 

-7 

xlO -6 

xlO' 

-5 

xlO' 

-5 

xlO' 

-5 

xlO' 

-5 


TABLE VIII. Lower bounds (Y^s^ 1,L ) an d npper bounds ( 11,U ) of Y^^ 11 in the 40 km experiment. These bounds are 
estimated assuming an infinitely long key. 


JaSi 3 

OzOz 

Ozlz 

IzOz 

lzlz OxOz 

Oxlz 

OzOx 

IzOx 

Ox Ox 

,11,1/ 
1 3 otSp 

0 

1.54 x 10 -3 

1.27 x 10“ 3 

0 6.92 x 10“ 4 

7.47 x 10 -4 

7.46 x 10“ 4 

5.86 x 10“ 4 

1.39 x 10“ 3 

y^ + ,ll,U 
1 3 asp 

2.36 x 10“ 6 

1.64 x 10" 3 

1.42 x 10“ 3 

2.77 x 10 -5 8.07 x 10“ 4 

8.08 x 10" 4 

8.15 x 10“ 4 

6.44 x 10" 4 

1.53 x 10 -3 



15 


X. Jiang, L. Zhang, J. Wang, L.-X. You, J.-Y. Guan, D.- 
X. Yang, Z. Wang, H. Liang, Z. Zhang, N. Zhou, X. Ma, 
T.-Y. Chen, Q. Zhang, and J.-W. Pan, Phys. Rev. Lett. 
113, 190501 (2014). 

[13] Y.-L. Tang, H.-L. Yin, S.-J. Chen, Y. Liu, W.-J. Zhang, 
X. Jiang, L. Zhang, J. Wang, L.-X. You, J.-Y. Guan, D.- 
X. Yang, Z. Wang, H. Liang, Z. Zhang, N. Zhou, X. Ma, 
T.-Y. Chen, Q. Zhang, and J.-W. Pan, IEEE J. Sel. T. 
Quantum Electron 21 , 6600407 (2015). 

[14] Y.-L. Tang, H.-L. Yin, Q. Zhao, H. Liu, X.-X. Sun, M.-Q. 
Huang, W.-J. Zhang, S.-J. Chen, L. Zhang, L.-X. You, 
Z. Wang, Y. Liu, C.-Y. Lu, X. Jiang, X. Ma, Q. Zhang, 
T.-Y. Chen, and J.-W. Pan, ArXiv e-prints (2015), 
arXiv: 1509.08389 [quant-ph]. 

[15] L. C. Comandar, M. Lucamarini, B. Frohlich, J. F. 
Dynes, A. W. Sharpe, S. Tam, Z. L. Yuan, R. V. 
Penty, and A. J. Shields, ArXiv e-prints (2015), 
arXiv: 1509.08137 [quant-ph]. 

[16] S. Pirandola, C. Ottaviani, G. Spedalieri, C. Weedbrook, 
S. L. Braunstein, S. Lloyd, T. Gehring, C. S. Jacobsen, 
and U. L. Andersen, Nature Photon. (2015); Z. Li, Y.-C. 
Zhang, F. Xu, X. Peng, and H. Guo, Phys. Rev. A 89, 
052301 (2014); X.-C. Ma, S.-H. Sun, M.-S. Jiang, M. Gui, 
and L.-M. Liang, Phys. Rev. A 89, 042335 (2014). 

[17] Z.-Q. Yin, C.-H. F. Fung, X. Ma, C.-M. Zhang, H.-W. 
Li, W. Chen, S. Wang, G.-C. Guo, and Z.-F. Han, Phys. 
Rev. A 88, 062322 (2013); Phys. Rev. A 90, 052319 
(2014); F. Xu, Phys. Rev. A 92, 012333 (2015). 

[18] D. Gottesman, H.-K. Lo, N. Lutkenhaus, and J. Preskill, 
Quant. Inf. Comput. 4, 325 (2004). 

[19] W.-Y. Hwang, Phys. Rev. Lett. 91, 057901 (2003); H.- 
K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. 94, 


230504 (2005); X.-B. Wang, Phys. Rev. Lett. 94, 230503 
(2005); Y. Zhao et al. , Phys. Rev. Lett. 96, 070502 
(2006); D. Rosenberg et al. , Phys. Rev. Lett. 98, 010503 
(2007); C.-Z. Peng et al ., Phys. Rev. Lett. 98, 010505 
(2007). 

[20] K. Tamaki, H.-K. Lo, C.-H. F. Fung, and B. Qi, Phys. 
Rev. A 85, 042307 (2012). 

[21] K. Tamaki, M. Curty, G. Kato, H.-K. Lo, and K. Azuma, 
Phys. Rev. A 90, 052314 (2014). 

[22] Similarly, the bounded dimensionality of the encoding 
space is also assumed in the semi-device independent 
QKD [31]. However loss-tolerant MDI-QKD gives a much 
higher key rate than semi-device independent QKD and 
is thus more practical. 

[23] F. Mizutani, M. Curty, C. C. W. Lim, N. Imoto, and 

K. Tamaki, arXiv:1504.08151 (2015). 

[24] F. Xu, K. Wei, S. Sajeed, S. Kaiser, S. Sun, Z. Tang, 

L. Qian, V. Makarov, and H.-K. Lo, arXiv: 1408.3667 
(2014). 

[25] F. Xu, M. Curty, B. Qi, and H.-K. Lo, New J. Phys. 15, 
113007 (2013). 

[26] Z. Cao, Z. Zhang, H.-K. Lo, and X. Ma, New J. Phys. 
17, 053014 (2015). 

[27] I. Lucio-Martinez, P. Chan, X. Mo, S. Hosier, and 
W. Tittel, New J. Phys. 11, 095001 (2009). 

[28] N. Peters, J. Altepeter, E. Jeffrey, D. Branning, and 
P. Kwiat, Quant. Inf. Comput. 3, 503 (2003). 

[29] R. Valivarthi et al , J. Mod. Opt. 62, 1141 (2015). 

[30] X. Ma, C.-H. F. Fung, and M. Razavi, Phys. Rev. A 86, 
052305 (2012). 

[31] M. Pawlowski and N. Brunner, Phys. Rev. A 84, 010302 

( 2011 ). 


